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(54) Spacecraft control system 

(57) With the evolution of satellites 
which are required to carry multiple 
missions comes the need for spacecraft 
sub-systems to perform increasingly 
complex functions. These could be car- 
ried out by using vastly more compli- 
cated conventional units containing 
standard random logic elements, but in 
order to retain a high degree of reliabil- 
ity and flexibility in implementation 
with a minimum penalty in terms of 
overheads such as mass and power 
requirement, long life-time computers 
are needed. 

in the system described a spacecraft 
computer function is split among a 
number of microcomputer modules 1 
which interface 4 to and communicate 
using a serial data bus 3 mechanism. A 
particular Addressable Serial Bus Inter- 
face Circuit device is described. 
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The drawings originally filed were informal and the print here reproduced is taken from a later filed formal copy. 
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SPECIFICATION 
Computer systems 

5 This invention relates to computer systems which are required to have as high a level of reliability as 5 
possible commensurate with as low mass and as low power requirement as possible. 

Such computer systems have particular, but not exclusive, utility in spacecraft, for example communica- 
tion satellites, which may be required to remain operational for periods of say ten years with little or no 
maintenance. 

10 According to one aspect of the present invention, a computer system includes at least one computer unit, 10 
at least one input/output unit, data bus interconnection means, and an interface unit connecting each 
computer unit and each input/output unit to the data bus interconnection means. 

By such an arrangement it is found that not only can the computer unit or units be readily designed for 
high reliability but they can be duplicated where desired in a relatively simple manner to provide 
15 redundancy. 15 
Preferably, the or each computer unit is such as to form a complete microcomputer including a central 
processor, programs, and data memory. The units can be any available microcomputer, for example Ferranti 
F100L, or Texas Instruments 9900. 
Preferably, the or each input/output unit is such as to provide an interface between the electronics 
20 associated with items of external equipment and the data bus interconnection means. 20 
Preferably the data bus interconnecting means comprises two lines each connected to each interface unit. 
One line carries a common continuous clock signal whilst the other carries bidirectional serial messages. 

Preferably each interface unit is such as to provide serial digital time-multiplexed data communication via 
the bus interconnection. Each unit preferably includes bus drive and receive circuitry together with transmit 
25 and receive logic. 25 
These and further aspects of the present invention are described by way of example with reference to the 
accompanying drawings in which - 
Figure 1 illustrates a computer system in diagrammatic form, 
Figure 2 illustrates an interface unit connected to the data bus interconnection, 
30 Figure 3 illustrates a logic sequence for an interface unit, 30 
Figure 4 illustrates a circuit diagram for an interface unit, 

Figure 5 is a word synchronisation and start bit detect timing scheme for an interface unit, 
Figure 6 is a receive timing scheme for an interface unit, 

Figure 7 is a transmit timing scheme for an interface unit, , 
35 Figure 8 illustrates the input/output signals associated with an interface unit, J 35 
Figure 9 illustrates a serial message format, / 
Figure 10 is an input circuit for an interface unit, 
Figure f1 is an output circuit for an interface unit, 

Figure 12 is a schematic arrangement of the connection between interface units and a data bus 
40 interconnection, and 40 
Figure 13 is similar to Figure 2 but illustrating a typical bought out microcomputer coupled to an interface 
unit. 

Referring initially to Figure 1, a computer system includes a plurality of self-contained microcomputers 1 
each comprising a micro processor complete with information store and supporting logic circuitry, a 
45 plurality of input/output units 2, and a data bus interconnection 3. Each unit 1 and 2 has an interface unit 4 45 
connecting it to the data bus interconnection means 3. 

Each input/output unit 2 provides a low level interface between the electronics associated with an item of 
external equipment and the serial data bus interconnection 3. In a satellite or spacecraft environment these 
input/output units 2 are associated with sensors, actuators, telemetry, and telecommand inputs for example. 
50 The data bus connection 3 comprises two wires common to each interface unit 4. One wire carries a 50 
continuous clock signal to all units 4, and the other carries bi-directional data. The latter wire thus carries 
serial messages between the units 4 and hence between any units 1 and 2. 

A third wire is optional and provides for arbitration should more than one microcomputer unit 1 be 
incorporated in the system. 

55 If required, due to the complexity of the system, a separate data bus control 5 and a separate timing unit 6 55 
may be provided, each being connected to the data bus interconnecting means 3 by an interface unit 4. 

Suitable interface units 4 are now described in detail with reference to Figures 2 to 13. Each unit 4 includes 
bus interface logic originally in the form of an uncommitted logic array such as the Ferranti ULA 5NOB 1J, 
and given a final customisation to the configuration of an addressable serial bus interface circuit (ASBIC). As 
60 before described, this provides interconnection between each unit 1, and each unit 2 to the data bus 60 
interconnection means 3 and hence to one another. Each unit 4 performs all data synchronisation, address 
detection, serial/parallel and parallel/serial conversion functions needed to achieve this. 
Thus, the main functions of each unit 4 are 
(a) Serial/parallel conversion, 
«c (h\ Parallel/serial conversion, 65 
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(c) Message detection and bit synchronisation, 

(d) Address detection. 

Its design can be summarised as follows. It centres around a 32 bit serial shift register (organised as two 
words x 1 6 bits) with parallel load and dump facilities. Serial messages are fed into this register, provided 
5 the unit 4 Is not busy (i.e. any previously received data has been read out by the unit user), while the 5 
message address field is s erially ch ecked. If the address field matches the prewired address of the unit 4, a 
low level is output over the RxiNTsignal line. The data received can then be accessed by the user over the 16 
bit wide parallel data highway. Data can be transmitted over the serial bus 3 by loading the shift registers via 
the bidirectional parallel data highway using the transmit control inputs, and then pulsing the SEND input 
10 line. (See timing diagram Figure 7). 10 
Each unit 4 uses a serial digital time-multiplexed scheme to communicate between up to 64 units 
connected in a system. The bus 3 consists of two wired connections between units 1 and 2 and, as previously 
mentioned, one forms a common continuous clock line distributed to all units 4. 
The clock frequency can range from 500 kHz down to DC dependent upon system requirements. The 
15 second wire forms a common bidirectional data line used, for example in half-duplex mode, to carry 15 
messages between units 4 and hence any units 1 and/or 2. 

Importantly, each unit 4 maintains synchronism to all messages on the data bus 3, whether or not it is busy 
(i.e. not able to read the message into its 32-bit register). Resynchronisation is automatically carried out on 
every message start bit received after the data bus has been inactive for at least one word length (32 bits). 
20 Communication between units takes place using a 32-bit long serial word, according to a versatile 20 
message transfer protocol. Bit allocation within the serial word has been left as flexible as possible; 
however, certain minimum bit assignations have been made as follows and as illustrated in Figure 9: 

25 BIT0 Message Start Bit. 25 

BITS 1-6 Unit address code- only the 

unit allocated this address will act upon the message received. 

30 BIT 7 Broadcast- when this bit is set, 30 

afl units connected to the serial 
bus act upon the message. 

BITS 8-31 User-assigned. 
35 35 

Referring now particularly to Figures 2 to 4, an interface unit 4 is described in detail. The description is 
conveniently partitioned as follows: 

40 Bit Count (see also serial message format Rgure 9) 40 
This comprises a dual 4-bit binary ripple counter (IC5) which is held in a reset state (count 0) at all times 
other than when a message is being either received or transmitted. The counter's 3 least significant bits are 
used by the Address Detect Logic, and bit count 8 (BIT 8) strobes the result of a comparison made on the 
destination address field of a ny incom ing messages (bits 1 -6). Bit count 32 terminates the transmit and 

45 receive sequences, causing a h X INT signal at IC9B if the message received contained a valid destination 45 
address. 

Word Sync and Start Bit Detect (See also timing diagram Figure 5) 
Two separate functions are provided here. The first is to perform initial synchronisation of the bit counter 

50 following power-up of the bus interface logic. 50 
It is possible that the interface could be powered up while a transfer is taking place on the serial data bus, 
making it impossible for the bit counter to synchronise to a start bit. This condition is allowed for by clearing 
the flip-flop IC2 OA at power up, which steers the data line signal DATAIN to the bit counter reset line (COUNT 
RESET) causing the counter to be reset to 0 every time a data bit is detected on the data bus line. This 

55 resetting persists until after the counter (IC5) has reached a count of 32, indicating that there has been no 55 
activity on the data bus for at least 32 bit times (1 word). Bit 32 causes the flip-flop ICI OA to change state, 
removing the DATAIN count reset path through IC 13A pin 3, but allowing a new path through IC 13A pin 4 
reset the bit counter and provide the second function of the logic block. This new reset signal is sourced by IC 
7 A (START COUNT), which holds the bit counter reset until the data bus line becomes active, indicating that 

60 a message start bit has arrived. This causes IC7A to change state removing the bit counter reset signal, 60 
allowing a count to be made of the incoming message bits. When the counter reaches Bit 32, flip-flop IC7A is 
cleared by RESET and once more applies a reset to the bit counter until another message start is detected. 

Address Detect 

65 Bits 1-6 of a serial message on the data bus contain the destination address of that message. This logic 65 
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(IC6, IC14A, IC7B and 1C9A) compares the incoming address code with a hard-wired unit address pathcode. 
The address check is performed serially as each address bit arrives. IC7B flip-flop is held in a cleared 
condition until a start bit has been detected and the bus interface is free to receive a message, i.e. the internal 
data registers are not busy. IC6 is an 8:1 data multiplexer, with the module address patchcode hard-wired to 
5 inputs D1-D6. Inputs DO and D7 are connected to the DATAIN line, so these bits of the incoming serial word 5 
always match the relevant input of the data multiplexer. 

While the message bit counter counts through bits 0-7, a 3-bit count code is used to address the data 
multiplexer, which steers the appropriate input line to the exclusive or gate IC14A. This gate compares each 
incoming data bit to the patchcode bit selected by the multiplexer, and the gate output is clocked into 

10 flip-flop IC7B at the middle of each data bit time. If any of the bits fail to match, IC7B toggles and stays in that 10 
state until reset at the end of the incoming data word. If all incoming bits matched, IC7B remains in its 
cleared condition. At bit time 8 (i.e. at the end of the address field), 1C9A is clocked and IC7B's output is 
strobed, either toggling IC9A or leaving it in a cleared condition. IC9Athen indicates whether the incoming 
address matched the pre-wired module address patchcode, holding its state (ADDRESS OK) until it is reset 

15 bythe user with a CLR.RX.INT signal. 15 

Busy and interrupt Control 

IC9B provides the busy and interrupt control functions. It is preset at power-up to a 'not busy' state, i.e. 
RXINT (Receive Interrupt) is not active. The flip-flop is clocked at the end of an incoming data message, BIT 

20 32, to check whether the messages' destination address matched the module's patchcode, or the Broadcast 20 
data bit (bit 7) was set in the message (for details of message format see Figure 9) this indicating that it was 
directed at all modules connected to the bus system. If either of these conditions are satisfied, IC9B toggles 
to make RXINT active. When the bus interface is being used within a unit 1 , this signal will cause an interrupt 
to be raised at the microcomputer's CPU to indicate that a message has arrived that th e interface needs 

25 servicing. The flip-flop can now only be reset by a signal from the user to CLR.RX INT. The state of the 25 
flip-flop in addition to being used to raise an interrupt line, is fed back to flip-flop IC8A as a 'busy' status. 1C8A 
is preset at the end of ail incoming messages, and can only be s et at the t ime a start bit is detected by IC7A 
and then only provided that IC9B is giving a 'not-busy' status via RX INT and RX INT signals. 
Should a start bit be detected before the interface has been serviced by the user, and before IC9B has been 

30 reset, no address checking will take place on the message, and no data will be clocked int o the int erface shift 30 
registers. However, the bit counter is activated and the start bit logic is reset at BIT 32 (via RESET) to ensure 
that synchronisation to the data bus is not lost. 

Data Registers 

35 These are 4 8-bit serial in, serial out, registers with parallel load and dump facilities. The registers have 35 
open-collector outputs and TTL inputs. They are organised in a 2 x 1 6 bit configuration, with a continuous 
serial data path, 32 bits in length. Only 16 output pins are used for access to the registers' parallel data lines, 
with each pair of registers being addressed via read and write control lines. The register contents are zeroed 
at power-up by applying a P.R. (Power Reset) signal to the register's MR (Master Reset) inputs. 



40 



40 



Receiving a Serial Message (see timing diagram Figure6) 

The read/write control signals to the registers set all parallel output lines to a non-active state, and instruct 
the registers to shift data right. Data is clocked from the DATAIN line into the serial input DS Q of ICI, out of the 
Q 7 serial output into DS D of IC2 and so on, until the message start bit reaches the Q7 stage of IC4 (at BIT 32 
45 time). The message is read by enabling the parallel open-collector output lines, one pair of registers at a 45 
time, by way of the READA/B and READC/D control signal inputs. 

Transmitting a Serial Message (see also timing diagram Figure 7) 
Data to be placed on the serial data bus is parallel loaded into the registers, one pair at a time, by way of 
50 the WRITEA/B and WRITEC/D control signals. The SHIFT mode status of the register is removed by resetting 50 

IC12A with a LOAD control signal, priming the registers for a parallel load operati on. 

The data presented is latched into the registers on the negative-going edge of a WRITE ENAB LE cont rol 

signal input by the user. When the registers have been loaded with the data to be transmitted, a SEND signal 

from the user allows the first serial data bit, IC4-Q7, on to the data bus via DATAOUT. This start bit is picked 
55 up by the start bit detect logic which beings to read the message. IC8B's ALLOW DATA output is used to 55 

change the phase of the clock being applied to the serial data registers (via IC1 4D). This ensures that each 

data bit is strobed into receiving interfaces half a clock pulse before DATAOUT is changed by the 

transmitting interface. 

60 Transmit Control ^ 60 

The control lines used to load parallel data into the data reg iste rs, and initiate transmission of a serial 
message are WRITEA/B WRITE C/D LOAD, WRITE ENABLE and SEND. IC1 2A is a latch, which is set at 
power reset time to produce a SHIFT signal, used by the data registers to indicate that a serial ri ght ope rating 
mode is required. The first control signal to be given by a user wishing to transmit a message is LOAD. This 

65 resets IC12A, removing the SHIFT mode control to the data registers. The data registers to be parallel-loaded 65 



JNSDOCID: <GB 2097564A 



4 GB 2 097 564 A 



then have their WRITEA/B (or C/D) control line activated which sets a parallel load mode for that pair of 
registers. Data is presented to the parallel interface D0-D15 and is latched into the registers when a clock 
pulse is applied to the CL register inputs. After both pairs of registers have been loaded the SEND control line 
is pulsed by the user. This sets IC1 2A f the mode control inputs to the data register reverting to serial shift 
5 right ope ration, an d also sets IC12B. This latch, together with IC8B f is reset at the end of each data bus 5 
message (RESET). The start bit of the message to be transmitted, held in register IC4, Q7, needs to be bit 
synchronised on to the data bus. This is performed by inhibiting the start bit, at IC15A, until IC8B flip-flop has 
detected a positive-going edge on the clock bus line. The flip-flop changes state and allows the start bit on to 
the data bus. 

10 10 

Clock Select 

IC13B steers one of the two clock sources to the data register clock inputs. When the interface is being 
loaded with data in parallel form by the user, the registers are clocked by way of a negative-going edge at the 
WRITE ENABLE input. At all other times the registers operate in serial shift right mode, and use the clock 

15 signal derived from the system clock bus. The system clock runs continuously, but IC13B only allows the 15 
pulses through to the shift registers while a message is in the process of being received or transmitted. The 
phase of system clock presented to the shift registers depends on whether a message is being transmitted or 
received - this is so that data can be clocked out on to the data bus on the rising edge of CLOCK, and read 
from the data bus on the falling edge of CLOCK. The clock phase is changed at the exclusive or element 

20 IC14D, by way of the ALLOW DATA signal generated when the interface is transmitting data. 20 

Interface unit 4 Inputl Output Signal Functions (see also Figure 8) 

Note that a positive logic convention is used here, thus a logical '0' condition is a 0V, or low, level and a 
logical '1' condition is a +5V, or high, level. 
25 Pins 4- 19 inclusive, Signal Name D0-D15 (16 lines) - these 16 bidirectional lines (with TTL inputs and 25 
open-collector outputs) are used to carry data that is eitherto be loaded into or read from the internal data 
registers. DO is the first message bit to be received or transmitted, i.e. the least significant bit 

Pin 35-^5^^- in the logical '0' condition, this output indicates that a message has been received over the 
serial data bus with either a valid destination address field or with the Broadcast bit set. 
30 An exception to this occurs following power-up of the unit 4. As soon as power reset has taken place, a 30 
synchronisation sequence is initiated during which the unit 4 reads from the serial data bus 3 waiting for a 
gap between messages of more than 32 bits. Once this gap has been detected, the unit 4 is cynchronised and 
can effect bus transfers.^^^-is set to the logical '0' condition after power reset to indicate to the user that 
synchronisation has been achieved. 
35 Pin 38, Data Out - this open-collector output line carries data from the data registers in serial form, for 35 
outputting to the serial data bus interface circuitry. 

Pin 39, Reg. Clock -This line provides a clock signal, derived either from the system clock bus orthe 
parallel data load clock. It is only present when a serial message is being either received or transmitted by 
the bus interface logic or when parallel data is being loaded. This signal is for use in units 1 or 2 where an 
40 external data register ha s been included, (see note 1 below). 40 

Pin 37 ALLOW DATA - A logical '0' condition on this output indicates the precise time when a message 
start bit may be placed on to the serial data bus. This signal is for use in units 1 and 2 where an external data 
register has been included. (Note 1 - some applications may benefit by using special shift registers, e.g. to 
simplify integration of an 8-bit microprocessor or to allow parallel inputs to the registers to be hard-wired to 
45 '1 ' or '0' l evels, as an alter native to the 1 6-bit bidirectional bussed configuration provided by the unit 4). 45 

Pin 36,~POWER RESET - in the logical '0' condition, this line indicates that a power-on reset is taking place. 

Pins 23 to 28 inclusive, A0-A5 (6 lines) - these 6 input lines are normally wired to either a logical '0' or 
logical '1 ' level to indicate the address of a unit 1 or 2. AO is the least significant bit of the message address 
field, and is the first address bit to arrive from the data bus. Unit address 0 will have all address lines 
50 connected to a logical '0' level, unit address 6 will have AO, A3, A4 and A5 connected to a logical '0' level and 50 
A1 and A2 connected to a logical 'V level. Any or all address lines may be connected to the DATAIN line, 
making any addres s lines so connected into 'don't care' bits. 

Pin 3, READ A/B - A logical '0' level on this input enables the output lines of the data registers A/B - these 
registers % contain the most significant 1 6 bits to arrive from the data bus - to allow the register contents to be 
55 read vi a the paral lel highway, D0-P1 5. 55 

Pin 2, READ C/D - A logical '0' level on this input enables the output lines of the data registers C/D; these 
registers contain the least signficant 1 6 bits of the 32 bit word, i.e. the first 1 6 bits to arrive from the data bus - 
to allow t he register c ontents to be read via the parallel data highway D0-D15. 

Pin 21 , WRITE A/B - A logical '0' condition on this line sets data registers A and B - the registers to contain 
60 the most significant 1 6 bits of the 32 bit word, i.e. the last 1 6 bits to be transmitted on the data bus - into their 60 
parallel l oad mode. 

Pin 22, WRITE C/D - A logical '0' condition on this line sets data registers C and D - the registers to contain 
the least sig nificant 1 6 bits of the 32 bit word, i.e. the first 1 6 bits to be transmitted on the data bus - into their 
parallel load mode. 

65 Pin 34, WRITE ENABLE- Anegative going pulse edge on this line causes data presented to the data 65 
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highway D0-D15to be latched into either data registers AIB or CID dependent upon the setting of the WRITE 
ATS and WRITE C/Dinput signals. 

Pin 33, LOAD - A logical '0' pulse on this input removes the serial shift light mode setting from all four data 
registers. NB. This input signal must be at a logical '1 ' level when instructing the bus interface to transmit 
5 data by way of t he SEND input described below. 

Pin 32, SEND - A logical '0' pulse on this input instructs the bus interface to transmit the 32 bits of data held 
in the data registers, commencing at the next positive-going edge of the bus systems clock (CLOCK). 

Pin 31,CLR.RXINT->4 logical '0' pulse on this input clears the RX INT output signal, and removes the bus 
interface's busy status, allowing the next complete message to be read from the data bus 3 into the data 
10 registers. The pulse must be a minimum of 8 clock cycles duration. 

Pin 30 - DATA IN - this line carries data from the serial data bus interface circuitry for inputting in serial 
form to the data registers. 

Pin 29 - CLOCK - this line carries the continuous bus system CLOCK pulses to the bus interface logic. 

Pin 1 RESET CR -This input signal is used to apply a slow positive going edge to the reset input schmitt 
15 trigger. While the inp ut voltage is belo w the schmitt trigger threshold, a reset condition is applied to the bus 
interface logic and the POWERRESET output line is held in a logical '0' condition. 

When the input voltage exceed s the schmitt trig ger threshold, the reset condition applied to the bus 
interface logic is released and the'POWERRESET output line changes to a logical '1 ' condition. 

Pin 40 + 5V - Power supply input connection. 
20 Pin 20 OV - connected to OV. 

The serial bus input circuitry, (see Figure 10), is designed around an LM1 19 high speed comparator 
integrated circuit; this is a precision high speed dual comparator fabricated on a single monlithic chip. 
Threshold level for noise immunity is set by resistors R2 and R4 with hysteresis provided by R3 to prevent 
oscillation when the device is switching. Diode D1 ensures that the serial bus input is protected against short 
25 circuits to OV in the LM119- short circuits to +5V can be resolved by removing power from the circuit. 

The output circuit, (see Figure 1 1), is basically an open -col lector driver made up of TR2 (2N2222A) which is 
permanently turned on whenever power is applied to the circuit, and TR1 (2N2369). TR2 and Dl afford OV 
short circuit protection to the serial bus; R3 assists the turning on of TR1 and R4, which is a low impedance, 
gives a fast switch-off. 

30 As previously referenced, there are two mandatory and one optional connections to be made between 
units 1 or 2 sharing the serial data bus. The direct links form a conceptually single-wire bus, no redundancy 
switching being needed to protect the wire itself against failure. Connections between the wire and each 
unit, though, do present a single point failure and this needs to be protected against by using two wires and 
two connections for each link (see Figure 1 2). The bus wires are individually screened to prevent crosstalk 

35 between the buses and to exclude noise induced signals from the bus system. 

Figure 13 shows a unit 4 being used to connect a unit 1, in this case a Texas Instruments 9900 
. microcomputer, to the serial data bus 3. The unit 4 provides conversion of incoming serial messages into 
two para Ifel 1 6-bit words, and makes these words accessible to the microcomputer data hig hway. Data can 
also be loaded from the microcomputer into the u nit 4, wh ere it is converted to a serial 32-bit word and 

40 output to the serial data bus 3. An 'interrupt' signal RxINT is generated when a serial message has been read 
in from the data bus, and the message destination address matches the address patchcode hardwired to the 
unit 4 input pins. (An interrupt is also generated if the 'Broadcast' bit is set in the message, regardless of the 
destination address bit setting). The unit 4 interfaces on one side to the microcomputer parallel data bus, the 
microcomputer consisting of, typically, a Central Processing Unit, memory decoder, memory, timing 

45 circuitry and any support chips needed for the specific application of the microcomputer unit 1. 

On the other side, circuitry to drive the single data bus line of item 3 perform threshold detection on 
incoming messages, and give single point failure protection is interposed between the actual bus wires and 
the unit 4 serial inputs and outputs. 



1. In a spacecraft, a distributed control system including a plurality of microprocessor-based computer 
system modules and a plurality of input/output modules coupled to each other by way of respective 
parallel/serial interface modules and a serial data communication bus. 
55 2. A distributed control system for a spacecraft substantially as hereinbefore described with reference to 
the accompanying drawings. 
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